agentware: Skill for Claude Code

Threat Modeling (STRIDE)

Portable Agent Skill (agentskills.io open standard). The YAML frontmatter above is the spec-compliant contract: name equals the folder name and description is the routing text. The body is HARNESS-AGNOSTIC — no hardcoded invocation syntax, no harness-only frontmatter. It needs no network and no external tools; it is a structured reasoning procedure applied to a design.

When to invoke: at design time, when a system or feature is being scoped and you need to enumerate WHAT can go wrong before deciding HOW to defend. Trigger it when the user asks to "threat model", run a "STRIDE analysis", map an "attack surface", or reason about abuse of a new endpoint, data flow, integration, queue, or agent/LLM loop. Use it AFTER secure-by-design has framed the requirements and BEFORE sast-audit scans real code: this skill produces the prioritized threat list those two bracket.

Why this skill exists

A requirements checklist (secure-by-design) tells you which controls a feature generally needs; a scanner (sast-audit) finds flaws in code that already exists. Neither systematically answers "given THIS architecture, what is the specific set of things an attacker can attempt, ranked by how much they hurt?" Threat modeling does. Without a written procedure, ad-hoc threat reasoning is biased toward the threats the author already knows and silently skips whole categories (repudiation, denial of service, elevation of privilege). STRIDE plus a data-flow decomposition forces coverage: every element of the system is walked against every threat category, so gaps surface as explicit "N/A, because…" notes rather than invisible omissions. The output is a durable artifact — a ranked threat table with a mitigation per threat — that the build, the tests, and a later security review all consume.

Prerequisites

• A description of the design: its components, the data they exchange, who calls them, and what they depend on externally. If the architecture is unstated or vague, ASK before modeling — a threat model built on a guessed data flow enumerates the wrong threats.
• This skill ENUMERATES and PROPOSES; it never weakens a control and never auto-applies an irreversible change (R-AUTO-02). Its product is analysis, not edits to running systems.
• Treat all crossing data — user input, third-party responses, file content, tool/LLM output — as untrusted at every boundary (R-SEC-02). Never put secrets in the model artifact, logs, or examples (R-SEC-01).